WorkPass Korea Privacy Policy

Effective date: [Registration in progress]

개인정보 보호법 §30 · §29 · §28-8 · §17 · §26

WorkPass CO., LTD. (the "Company") establishes and discloses this Privacy Policy as follows in accordance with Article 30 of the 개인정보 보호법 (Personal Information Protection Act, "PIPA"), so as to protect the personal information of data subjects and to handle related grievances swiftly and smoothly.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes, and processed personal information shall not be used for purposes other than the following. 1. Member sign-up and management: verification of membership qualification, identity verification, prevention of fraudulent use 2. Job placement and job/job-seeker matching: candidate recommendation, provision of job/job-seeker information, support for concluding employment contracts 3. Verification of Employer Members: business identity confirmation and verification 4. Calculation and payment of 소개요금: 소개요금 agreement, payment, tax invoice issuance, refund processing 5. Provision of administrative/living information and materials 6. Grievance handling and dispute response 7. Fulfillment of statutory obligations and record retention

Article 2 (Categories of Personal Information Processed)

① The Company processes the following categories of personal information. 1. Common required items: name, email, password, mobile phone number, nationality 2. Job-seeker Member items: status of stay (visa type), desired occupation/region, work experience, education, language ability 3. Employer Member items: trade name, business registration number, representative name, opening date, contact person's name and contact, workplace information 4. 소개요금 payment-related items: payment method information, tax invoice issuance information 5. Automatically collected items: access IP, cookies, service usage records, device information ② The Company collects personal information to the minimum extent necessary for providing the Service, and shall not restrict use of the Service on the ground that optional items are not provided.

Article 3 (Processing of Unique Identifiers)

① The Company may process the following unique identifiers for the purpose of confirming foreigners' status of stay and employment eligibility and fulfilling statutory obligations related to employment contracts and 소개요금. 1. Alien Registration Number 2. Passport Number ② When processing the unique identifiers of Paragraph 1, the Company obtains consent from the data subject separately from consent for the processing of other personal information, and notifies that the data subject has the right not to consent. ③ The Company does not provide unique identifiers to third parties except as prescribed by relevant statutes, and safely manages them by taking necessary measures such as encryption.

Article 4 (Processing and Retention Period of Personal Information)

① The Company processes and retains personal information within the retention/use period as prescribed by statute or agreed upon by the data subject at the time of collection. ② Individual processing and retention periods are as follows. 1. Member information: until member withdrawal. Provided that where disputes/investigations due to statutory violations are in progress, until such procedures are concluded 2. Job placement ledgers and documents (job-order applications and register, job-seeker applications and placement register, 소개요금 agreements, cash book): 2 years under Article 26 of the Enforcement Rule of 「직업안정법」 3. Records on contracts or withdrawal of subscription, payment for goods, and supply of goods: 5 years pursuant to the Act on Consumer Protection in Electronic Commerce, etc. 4. Records on consumer complaints or dispute handling: 3 years 5. Records on display and advertisement: 6 months ③ Personal information whose retention period has expired shall be destroyed without delay.

Article 5 (Provision of Personal Information to Third Parties)

① The Company processes the personal information of data subjects only within the scope specified in Article 1, and provides personal information to third parties only where 「개인정보 보호법」 Article 17 and Article 18 apply, such as data subject consent or special provisions of law. ② Due to the nature of the job placement service, where information provision between Employer Members and Job-seeker Members is necessary, the Company provides information within the necessary scope after obtaining separate consent from the data subject; the specifics follow the 「Third Party Provision Consent」.

Article 6 (Delegation of Personal Information Processing)

① For smooth service provision, the Company may delegate personal information processing to external parties. When delegating, the Company discloses the delegatee and the content of the delegated work through this Policy. ② When concluding a delegation contract, the Company stipulates matters concerning safe management of personal information under Article 26 of 「개인정보 보호법」 in the contract, and supervises whether the delegatee safely processes personal information. ③ The delegatees and the content of delegated work are as follows. 1. Cloud infrastructure: Vercel Inc. (web), Railway Corporation (API server), Supabase Inc. (database and file storage) — web delivery, API server operation, data storage and system operation 2. Email/notification delivery: Resend, Inc. (email delivery) — service notices and alerts ④ 소개요금 is received by bank transfer to the corporate account — no payment gateway (PG); the Company does not delegate payment processing (PG) to any third party.

Article 7 (Overseas Transfer of Personal Information)

① The Company may store and process personal information in overseas cloud infrastructure, etc. for service operation, in which case it obtains consent from data subjects under Article 28-8 of 「개인정보 보호법」 or complies with requirements prescribed by statute. ② The specifics regarding overseas transfer of personal information follow the 「Overseas Transfer Consent」.

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives, and Method of Exercise)

① Data subjects may exercise the rights to view, correct, delete, or suspend processing of personal information against the Company at any time. ② The exercise of rights under Paragraph 1 may be made to the Company via written form, email, etc., and the Company shall take action without delay. ③ Data subjects shall not infringe personal information and privacy of themselves or others whose information is processed by the Company, in violation of relevant statutes.

Article 9 (Measures for Ensuring Safety of Personal Information)

Pursuant to Article 29 of 「개인정보 보호법」, the Company takes the following technical, administrative, and physical measures necessary for ensuring safety. 1. Administrative measures: establishment and implementation of internal management plans, regular staff training 2. Technical measures: access privilege management for personal information processing systems, installation of access control systems, encryption of unique identifiers, installation of security programs 3. Physical measures: access control of computer rooms, data storage rooms, etc.

Article 10 (Privacy Officer and Remedies for Rights Infringement)

① The Company designates a Privacy Officer to comprehensively oversee personal information processing and to handle complaints and remedies of data subjects related to personal information processing. - Privacy Officer: [Registration in progress] ② Data subjects may apply for dispute resolution or consultation with the following organizations to receive remedies for personal information infringement. - 개인정보 분쟁조정위원회 (dial 1833-6972 / www.kopico.go.kr) - 개인정보 침해신고센터 (dial 118 / privacy.kisa.or.kr) - 대검찰청 사이버수사과 (dial 1301 / www.spo.go.kr) - 경찰청 사이버수사국 (dial 182 / cyberbureau.police.go.kr) ③ When the Company amends this Privacy Policy, the reason and content of the amendment shall be announced at least 7 days before the effective date.

Addendum

This Policy takes effect on [Registration in progress].